This invention relates to electronic commerce transactions. More particularly, this invention relates to systems and methods for secure electronic interchange of commerce documents and instruments by trading participants.
Interchange of commerce documents and instruments between business trading partners takes place today both electronically and otherwise. Examples of common commerce documents include payment instruction receipts, purchase orders and receipts, and contracts. Examples of common commerce instruments are payment instructions (e.g., checks, credit cards) and currency. Techniques, practices, rules, and laws exist to engender confidence that transactions are executed according to conventional understanding of each trading partner. The commercial interchange has played a vital role in the growth of the world""s commerce systems. Moreover, the commercial interchange has become increasingly important as transactions have evolved beyond the roots of face-to-face contact between trading partners to transactions between remotely located trading partners who never meet and may even reside in different countries.
As the pace, quantity, and breadth of commerce expands, there is a continuing need to expand the role of electronic processing in commercial interchange. Coincident with this expansion is the need to preserve the safeguards that have been historically developed to protect the interests of trading partners and minimize the risks to all participants. Authenticity, integrity, privacy, and security are among the principal requirements of an effective commerce system. The commercial participants must be authentic and the documents and instruments must have integrity. Additionally, the nature and terms of commerce transactions should be kept private and confidential among the participants. Moreover, there are circumstances where certain information (e.g., account numbers) may even be safeguarded within the set of participants.
Several problems arise when attempting to satisfy these requirements, particularly in an electronic setting. For instance, participants to a transaction might be impersonated, signatures on documents are subject to forgery, and the documents themselves are subject to undetectable alteration. Standardized rules and practices exist in the manual, non-electronic setting to minimize the risks of such problems. A notary signature is one such conventional practice. In the electronic arena, the risks have been traditionally mitigated by instituting proprietary commerce systems that are closed to the general public and by maintaining high security protocols on such proprietary systems. Hence, participants and documents are authenticated by definition, explicit signing is not required, and the integrity of the trading information and value are preserved within the confines of the closed processing system.
As personal computer (PC) technology continues to evolve, even greater electronic processing capabilities are being distributed into the hands of potential trading partners. Consumers, purchasing agents, merchants, suppliers, manufacturers, and financial institutions are but a few of the possible participants with easy access to significant electronic computing and communications tools and resources. PCs are natural tools to expand the quantity and breadth of commercial interchange. In order to reach the broadest possible audience of potential trading partners, however, an electronic PC-based commerce system must be designed without reliance on exclusive, closed, proprietary systems and networks.
This invention provides an electronic commerce system that facilitates commercial interchange of documents and instruments in a large, unrestricted audience of participants, while supporting the underlying principles of authenticity, integrity, privacy, and security. The electronic commerce system has a credential binding server at a trusted credential authority and multiple computing units at associated participants. The credential binding server and the multiple computing units are interconnected by a communication system, which is publicly available and can be already in existence. Example communication systems include an interactive television system, a credit card network, an ATM (Asynchronous Transfer Mode) switching network, a public network, a wide area network, a satellite network, and an RF network.
The participants initially register with the trusted credential authority for the right to participate in the electronic commerce system. Each computing unit generates and sends a registration packet over the communication system to the credential binding server. The packets are encrypted to promote security and privacy since the communication system is presumed to be inherently insecure and open to eavesdroppers. The packets also contain the digital signature of the participants to promote authenticity and integrity.
The credential binding server decrypts the packets, verifies their authenticity and integrity as originating from the participants, and produces a unique credential for each registering participant. The credential binding server digitally signs each credential on behalf of the trusted authority and sends the credentials to the appropriate participants. The participants are now equipped with credentials to participate in commercial activity over the electronic commerce system.
The transaction process takes place in an efficient manner between registered participants, and does not require any interaction with the trusted authority. An originating computing unit (e.g., a PC or set-top box at a purchaser""s house) initiates a transaction by requesting and receiving the credentials of all intended recipient computing units (e.g., servers located at a merchant""s facility and at a bank). The originating computing unit verifies the authenticity of the credentials by checking the digital signature of the trusted authority. If valid, the originating computing commences the commercial interchange.
The originating computer unit generates a set of one or more commerce documents that defines the transaction, and a set of one or more commerce instruments that defines the payment method for the transaction. The originating computer unit digitally signs the document(s) and instrument(s), and then encrypts them differently to insure that only the intended recipient for each can decrypt them. For instance, the originating computing unit might encrypt a commerce document using a symmetric encryption key, and then encrypt that key with a public key of the merchant that is intended to receive the document. In this way, only the intended recipient (i.e., the merchant) can decrypt the symmetric key by using its private key that matches the public encryption key. The intended recipient can then decrypt the document using the recovered symmetric key.
An instrument, on the other hand, is encrypted using another symmetric encryption key which is then encrypted using a public key of a second recipient (i.e., the bank) that is intended to receive the instrument. As a result, only the bank can open the encrypted instrument. It is further noted that in this example, the merchant cannot decrypt the instrument, nor can the bank decrypt the document, thereby ensuring privacy and security over the open communication system. The degree of security for the documents and instruments can be varied according to the strength of the chosen cryptographic keys.
The originating computer unit sends both the document(s) and instrument(s) to the first recipient participant (i.e., the merchant). The first recipient participant decrypts the symmetric key using its private key, and then decrypts the document using the decrypted symmetric key. The first recipient participant verifies the digital signature of the originating participant to assure itself that the document is legitimate and that it has not been altered since its generation by the originating computing unit. Unable to open the instrument, the first recipient participant passes the encrypted instrument onto a second recipient participant (i.e., the acquiring bank) for whom it was intended. The second recipient participant decrypts and verifies the instrument.
The second recipient participant returns a signed encrypted authorization receipt to the first recipient participant, for example, to guarantee payment for the ordered items. The first recipient participant then returns a signed encrypted purchase receipt to the originating participant to indicate that the purchase is approved and accepted.
The electronic commerce system according to this invention can be implemented with existing commercial systems. In one implementation, the commerce system is incorporated into a credit card system to facilitate purchase transactions between a consumer and a merchant, while complementing the existing credit card network that performs the payment card authorization and settlement process between the acquiring and issuing banks. In another implementation, the commerce system is incorporated into an interactive television system.
Each computing unit executes a commerce application to facilitate the document interchange. To perform the encryption, decryption, signing and verification functions, each computing unit in the electronic commerce system is loaded with a cryptography system which supports the commerce application. The cryptography system is software or combination software/hardware based system that operates on the computing units as a service layer to operating system commerce application. The cryptography system has a unique tri-layer architecture. It includes a cryptographic application program interface (CAPI) which provides functionality to the commerce application, one or more cryptographic service providers (CSP) which implement the functionality presented by the CAPI to the application, and one or more private application program interfaces (PAPI) which allow the CSPs to communicate directly with a user.
The CSPs perform the cryptography functions and manage the cryptographic keys. Preferably, the CSPs are implemented as dynamic linked libraries (DLLs) that are loaded on demand and authenticated by the CAPI, and then called to by the commerce application. To promote security, the commerce application does not ever gain direct access to the keys maintained in the CSPs, but is permitted to manipulate the keys only through the use of handles assigned by the CSPs to the keys. With this architecture, the DLLs can be modified or replaced without affecting the higher level commerce application.
The electronic commerce system satisfies the following design objectives:
1. Access to commercial interchange capabilities is ubiquitous. The electronic commerce system operates on existing public and private communication networks that vary widely in terms of architecture and implementation. The electronic commerce system is not implementation dependent and does not practice protocols that exclude use of certain networks.
2. Accommodates accepted principles of commerce. The electronic commerce system provides the standards of authenticity, integrity, and privacy. Additionally, it supports convenient, secure, and verifiable interchanges even though the communication systems are insecure and subject to attack by criminals attempting to steal or compromise commercially valuable information.
3. Complements existing electronic processing systems. The electronic commerce system interfaces with existing, entrenched commerce processing systems, such as the credit card network.
4. Adaptability to different commerce environments. The electronic commerce system can be implemented in vastly different commerce settings. Since the system is PC-based, and works over essentially any type of communication network, it can be easily adapted to different environments. Additionally, security levels and such can be prescribed according to the wishes of the commerce system owners by simply changing the CSP modules used to perform the cryptographic functions.
5. Conforms to acceptable regulatory and legal practices. By modifying the CSPs, the electronic commerce system can be flexibly adjusted to meet different regulations imposed by various governments. Regulated technologies, such as encryption and decryption, can be readily controlled within the system.